thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Subdomain Takeover

Gaining control of a subdomain whose DNS record points to a deprovisioned external resource, such as a deleted cloud bucket or app.

Definition

A dangling CNAME to an unclaimed service lets an attacker register that resource and serve content on the trusted subdomain, enabling phishing, cookie theft or CSP bypass. Mitigations include removing DNS records before deprovisioning resources and monitoring for dangling records.

Example

shop.example.com still points to a deleted cloud app name, which an attacker re-registers.

Exam tip

Fix the process: delete DNS records when decommissioning resources.

Related terms